As I suspected, it looks to me like common or garden spam, hence the scare quotes. Of course, I can't be absolutely certain without digging further into the actual URLs, which I'm not about to do, but everything about these comments screams pingbacks or trackbacks. And the solution is obviously Akismet which, to be honest, I am suprised Phoneboy has not already installed and activated.

The day may come when webmention spam is a thing, and #indieweb people have been thinking about a protocol called Vouch for that eventuality.

And I’m not sure what that means. What right settings? Doesn’t WordPress keep a copy of all comments it receives? It would be really useful to see the contents of those “spam webmentions,” where they came from, what they contained, who sent them, simply because, as I said before, so few of these imagined evils have so far been spotted in the open. Not sure what settings that requires.

If you're looking for a really good introduction to the #IndieWeb and insights into how it all works, you could do a lot worse than listen to Jeena's podcast with Martijn. They do a tip-top job of explaining for people less knowledgeable than they are, and the audio quality is very acceptable.